saymrwulf/proof-aware-crypto-tooling-agent
1
0
Fork 0
mirror of https://github.com/saymrwulf/proof-aware-crypto-tooling-agent.git synced 2026-09-03 19:53:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

web: publish the SLH-DSA verification key the same way as the Ed25519 one

Browse source 
/v1/log-slhdsa-public-key, mirroring /v1/log-public-key exactly: same route
shape, same two-independent-locations TOFU rule (site copy + git mirror
copy). The operator decision of 2026-08-06 required the SLH-DSA public key
published like the Ed25519 key; the mirror half shipped with the tree-19
publication, this is the site half. Suite 152/0/0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
mrwulf 2026-08-07 17:55:46 +02:00
parent b232265264
commit 0d83dc3ec1
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
provider/src/pacta_provider/web.py
View file

@ -65,11 +65,16 @@ def make_handler(log: TransparencyLog, base_path: str, docs_html: str, paper_pdf
self.send_header("Content-Length", str(len(body))) self.send_header("Content-Length", str(len(body)))
self.end_headers() self.end_headers()
self.wfile.write(body) self.wfile.write(body)
elif route == "/log-public-key": elif route in ("/log-public-key", "/log-slhdsa-public-key"):
# TOFU mitigation depends on the key being published in two # TOFU mitigation depends on the key being published in two
# independent locations; this is the site's copy (the mirror # independent locations; this is the site's copy (the mirror
# carries the other). Serving only a fingerprint would not do. # carries the other). Serving only a fingerprint would not do.
key_path = Path(log.log_dir) / "provider.ed25519.pub" # The SLH-DSA key (additive post-quantum signature, 2026-08)
# is published THE SAME WAY as the Ed25519 one — same route
# shape, same two-location rule.
fname = ("provider.ed25519.pub" if route == "/log-public-key"
else "provider.slhdsa.pub")
key_path = Path(log.log_dir) / fname
if not key_path.is_file(): if not key_path.is_file():
self._send(404, {"error": "log public key not present in this log directory"}) self._send(404, {"error": "log public key not present in this log directory"})
return return
@ -152,6 +157,7 @@ def make_handler(log: TransparencyLog, base_path: str, docs_html: str, paper_pdf
f"{base}/docs", f"{base}/docs",
f"{base}/paper", f"{base}/paper",
f"{base}/log-public-key", f"{base}/log-public-key",
f"{base}/log-slhdsa-public-key",
f"{base}/healthz", f"{base}/healthz",
f"{base}/{API_VERSION}/metadata", f"{base}/{API_VERSION}/metadata",
f"{base}/{API_VERSION}/sth", f"{base}/{API_VERSION}/sth",